Salon booking system <= 10.31.6 - Authenticated (Salon Staff+) Stored Cross-Site Scripting via Customer Notes
- ID
- WPSEC-2026-0162
- Plugin
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (salon-booking-system)
- Affected
- all versions before 10.31.7
- Remediation
- Update to 10.31.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Salon booking system on WPSec AttackSurface
- Fix released
- Published
Description
The Salon Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer 'Personal note' and 'Administration note' fields in all versions up to, and including, 10.31.6 due to insufficient input sanitization and output escaping. The notes were stored unsanitized by the mobile REST API booking create and update endpoints (salon/api/mobile/v1/bookings, 'customer_personal_note' parameter) and by the customer CSV import on the Tools page, and were echoed unescaped inside a textarea on the admin customer edit screen (Salon > Customers). This makes it possible for authenticated attackers with the Salon Staff role or higher, who have the manage_salon capability but not unfiltered_html, to inject arbitrary web scripts that execute when an administrator views the affected customer's profile.
References
- https://wpsec.com/vuln/WPSEC-2026-0162/
- https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.7/
- https://wordpress.org/plugins/salon-booking-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS